CVE catalog

CVE-2011-3872

puppet - programming error

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.52% · Oct 25, 2026

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpuppet112.7.6-1fixed
Debianpuppet5.00.24.5-3vulnerable
Debianpuppet5.00.24.5-3+lenny1vulnerable
Debianpuppet5.00.24.5-3+lenny2fixed
Debianpuppet6.02.6.2-4vulnerable
Debianpuppet6.02.6.2-5vulnerable
Debianpuppet6.02.6.2-5+squeeze1vulnerable
Debianpuppet6.02.6.2-5+squeeze3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpuppetdeb112.7.6-1Not reportedDEBIAN-CVE-2011-3872Not reported
Debianpuppetdeb5.00.24.5-3+lenny2Not reportedDSA-2352-1Not reported
Debianpuppetdeb6.02.6.2-5+squeeze3Not reportedDSA-2352-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]